Skip to content
brandefense.io
Request A Demo
Nation-state APTEspionageAdvanced sophistication · State-backed

DragonOK

DragonOK is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 8 sectors, including Government and Technology, in 4 countries, including Japan and Russia. It uses 7 MITRE ATT&CK techniques and exploits 2 known CVEs.

Also known as
  • Bronze Overbrook
  • Shallow Taurus
  • G0017
Request IOC feedRequest ATT&CK export
Origin
China
Techniques
7
Exploited CVEs
2
First seen
Jan 1, 2013
Last seen
Sep 1, 2025
Record updated

Who They Target.

Sectors · 8
Countries · 4

About DragonOK.

DragonOK is a threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, DragonOK is thought to have a direct or indirect relationship with the threat group Moafee. It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT.

Last updated Sep 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.